The technical field of the present invention relates to a detection method for abnormal traffic which has the possibility of DoS (Denial of Service) attack in a network, and a packet relay apparatus which is used for the method.
A typical example of DoS attack is that an attacker launches a very large amount of access on a target via a network, thereby makes the resources (memories, CPU power, etc.) of the target consumed, and prevents originally intended services from being carried out. The targets of the attack are networks and apparatuses which are connected to networks and provide various services (servers, packet relay apparatuses (routers, switches), etc.).
As a technology of detecting DoS attack, there is a flow monitoring technology which is known under the name of NetFlow. The NetFlow is stipulated in Non-patent Reference 1. In the NetFlow, when a packet relay apparatus receives packets, packets are sampled at a rate of 1/n (at a rate of one packet to n packets) and the number of packets and the number of bytes are statistically counted for a series of packets (referred to as “flow”) which have identical values in seven information items ((1) a source IP address, (2) a destination IP address, (3) an IP upper level protocol number, (4) a TCP (or UDP) source port number, (5) a TCP (or UDP) destination port number, (6) an IPTOS (FlowLabel in the IPv6), and (7) an SNMP index number of an input interface). The packet relay apparatus transforms the statistics and relevant information of the flow into the format of a NetFlow export datagram (described in Non-patent Reference 1) and transmits the datagram to an external server called a collector when one of the following conditions is satisfied.
The conditions are: (1) the idle time of a flow exceeds a predetermined time; (2) the TCP connection of a flow terminates (at the time of the reception of the packet of FIN=ON or RST=ON in the TCP); and (3) the holding time of a flow exceeds a predetermined time. A collector detects a flow having outstandingly large numbers of packets and bytes (a flow suspected to be DoS attack) by analyzing the statistics and relevant information.
[Non-patent Reference 1]
IETF RFC3954 (B. Claise, “Cisco Systems NetFlow Services Export Version 9,” [online], October 2004, IETF, [searched on Aug. 22, 2005], Internet <URL:http://www.ietf.org/rfc/rfc3954.txt?number=3954>)